How we decide
what's suspicious.

We report suspicion, not guilt.

A score above our alert threshold means a domain name looks statistically similar to something on your watch-list, and that similarity is unusual enough to warrant your attention. It does not mean:

• The domain is actively phishing anyone
• The domain was registered with intent to harm you
• The domain owner has malicious intent

Many matches are legitimate: a competitor who includes your brand name in a keyword, a parked domain purchased years ago, a security researcher's test environment. We state this clearly in every alert we send.

Four tiers.

Thresholds are adjustable per tenant. High-risk sectors (banking, crypto) typically lower the immediate alert threshold to 65–70 to catch more borderline cases.

Eight stages, microseconds each.

Every certificate that appears in a public CT log passes through the same pipeline before we decide whether to store or alert.

1. Normalize — lowercase, strip leading *. wildcard, trim whitespace.
2. Punycode decode — convert ACE labels (xn--) to Unicode so homoglyph detection works correctly.
3. Skeleton fold — apply Unicode confusables mapping and our Turkish-extended skeleton map to collapse visually similar characters (e.g. garantı → garanti).
4. eTLD+1 extraction — strip subdomains and TLD using the public suffix list. Scoring targets the registrable domain.
5. Fast reject — check the domain against a Bloom-filter preload of the Tranco top-1M and your own domains. Known-safe domains are discarded here, before any expensive computation. This is what lets us process roughly 10 million certificates per day without scaling problems.
6. Tokenise — split the domain on hyphens, dots, and digit boundaries to isolate brand-relevant substrings.
7. Term match — compare tokens against your watch-list using the signal families below.
8. Aggregate and tier — sum signal contributions into a final score; apply the tier thresholds above.

What moves the score.

Signals are grouped into families. We publish the families and their direction — we don't publish exact weights, because weights are recalibrated periodically and because publishing them makes evasion cheap.

Context before we alert.

For candidates that cross the digest threshold, we run an enrichment pass before storing or alerting. Enrichment provides context and can lower a score as well as confirm it.

Enrichment steps: a single HTTP HEAD request (GET if HEAD fails), a DNS lookup, and registration age from RDAP/WHOIS. For technical details on what we send and how to opt out, see our scanner page.

Enrichment signals that decrease confidence:

• Domain does not resolve (NXDOMAIN) — parked or unregistered
• HTTP status 200 serving a generic parking page
• Registration date predates the brand term by years — likely pre-existing

A domain that scores 75 pre-enrichment but turns out to be a decade-old parked page may not reach your inbox at all. Enrichment is the last line of false-positive defence.

We expect false positives.

An automated system running at CT-log scale will produce false positives. Our goal is to keep the ratio low enough that alerts remain actionable — not to eliminate false positives by raising the threshold, which would also eliminate true positives.

If you consistently see false-positive domains matching a particular pattern, you can add those patterns to your suppress-list and we'll filter them before delivery. Suppression rules are tunable without changing your alert threshold.

What ArgusLeaf is not.

We are a detection system, not an investigation or remediation service. We don't:

• ✕Determine intent (criminal, civil, or innocent)
• ✕Perform active security testing of found domains
• ✕Contact domain owners on your behalf
• ✕Issue takedown notices
• ✕Provide legal opinions or advice

For takedown and legal action, contact an IP or trademark attorney, or use your registrar's abuse mechanism.

What we read.

• Certificate Transparency logs via RFC 6962 tile streaming (primary source)
• Newly registered domain feeds — CZDS zone files and public registrar APIs
• Public phishing intelligence feeds — redistributable entries only; non-redistributable entries are suppressed and never shown to tenants
• WHOIS / RDAP for registration date
• Passive DNS for enrichment context

We do not use active port scanning, vulnerability databases, or dark-web sources.